CVE-2026-68385 Overview
CVE-2026-68385 is a Linux kernel vulnerability in the s390 architecture checksum implementation. The csum_partial() function calls csum_copy() with copy=false and dst=NULL. On s390 machines without the vector facility, csum_copy() falls back to cksm(dst, ...), causing the checksum to be calculated from address zero instead of the intended source buffer. The upstream fix passes src to cksm() so the fallback path matches the vector extension (VX) implementation, which already checksums data loaded from src.
Critical Impact
Incorrect checksum computation on s390 systems without the vector facility can corrupt network packet validation and file integrity checks, leading to data integrity failures and potential kernel information disclosure from address zero.
Affected Products
- Linux kernel s390 architecture builds without the vector facility
- Kernel branches prior to commits 1d9a2f01, 4bb06b60, 5fc0a2a6, and 898bb281
- IBM Z / LinuxONE systems running affected kernel versions
Discovery Timeline
- 2026-08-10 - CVE-2026-68385 published to the National Vulnerability Database (NVD)
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-68385
Vulnerability Analysis
The defect lives in the s390-specific checksum path in the Linux kernel. csum_partial() computes the Internet checksum over a memory buffer and is called extensively by the networking stack. On s390, the implementation delegates to csum_copy() with a copy=false argument and a NULL destination pointer, since no data movement is required.
When the CPU exposes the vector facility, the vector extension path correctly loads bytes from src and folds them into the running checksum. When the vector facility is unavailable, control flows into the fallback branch that invokes the cksm instruction. The fallback passed the dst pointer to cksm() instead of src. Because dst is NULL, the instruction summed memory starting at virtual address zero rather than the caller-supplied buffer.
The consequence is a checksum that has no relationship to the data the caller intended to protect. Network packets, protocol headers, and any subsystem depending on csum_partial() receive an incorrect value. Callers that trust the return value may accept corrupted data or reject valid data.
Root Cause
The root cause is an incorrect argument passed to the cksm instruction wrapper on the non-vector fallback path. csum_copy() used its dst parameter as the checksum source when it should have used src. Since csum_partial() supplies dst=NULL, the fallback dereferenced page zero.
Attack Vector
Exploitation requires the ability to influence data flowing through kernel code paths that call csum_partial() on affected s390 hardware. The attack surface centers on the network stack, where remote attackers can send crafted packets that reach checksum validation routines. Reading from address zero can also leak the contents of the zero page into checksum values that are transmitted on the wire, depending on kernel configuration.
The vulnerability is only reachable on s390 systems that lack the vector facility, which narrows exposure to specific IBM Z generations and virtualized guests configured without VX support.
See the upstream fix commits 1d9a2f01, 4bb06b60, 5fc0a2a6, and 898bb281 for the exact code change.
Detection Methods for CVE-2026-68385
Indicators of Compromise
- Unexpected TCP or UDP checksum failures reported by peers communicating with s390 hosts running affected kernels
- Kernel messages referencing page-zero access or unusual faults from checksum routines on s390 CPUs without the vector facility
- Application-level integrity check failures for data flowing through kernel checksum paths
Detection Strategies
- Inventory s390 hosts and identify which run kernel builds predating the referenced stable commits
- Query /proc/cpuinfo and kernel boot logs for the presence or absence of the vector facility on each s390 system
- Compare deployed kernel versions against the fixed commit hashes across development, staging, and production fleets
Monitoring Recommendations
- Alert on spikes in checksum error counters exposed through netstat -s on s390 hosts
- Forward kernel logs from s390 systems to a central data lake and correlate checksum-related warnings with network anomalies
- Track patch state of Linux kernel packages across s390 assets and flag hosts still running the vulnerable code paths
How to Mitigate CVE-2026-68385
Immediate Actions Required
- Apply the upstream stable kernel updates that include the four referenced commits to all affected s390 systems
- Prioritize hosts that lack the vector facility, since only those systems execute the vulnerable fallback
- Restart affected systems after installing the updated kernel to load the fixed checksum routines
Patch Information
The fix ships in Linux stable kernel commits 1d9a2f01b3c4e5c88e06b2db4b5460c2ec884722, 4bb06b60d982355e22647b3d12d6619419f8c1fa, 5fc0a2a6eeb99cac991242bb48796c7749ce3261, and 898bb2814f38399108bdd2113f38d97383a7036a. The patch passes src rather than dst into cksm() so the fallback matches the vector implementation. Distribution vendors backport these commits into their supported kernel branches. Consult your Linux distribution's advisory feed for the specific package version that carries the fix.
Workarounds
- Run affected workloads on s390 hardware or guests that expose the vector facility, which bypasses the vulnerable fallback path
- Migrate sensitive workloads off unpatched s390 hosts until the fixed kernel is deployed
- Constrain untrusted network access to affected hosts until patching is complete
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
